Procedure examples

Amadey has collected the computer name and OS version from a compromised machine.

Proxysvc collects the OS version, country name, MAC address, computer name, and physical memory statistics.

Orz can gather the victim OS version and whether it is 64 or 32 bit.

NOKKI can gather information on the operating system on the victim’s machine.

yty gathers the computer name, CPU information, Microsoft Windows version, and runs the command systeminfo.

Backdoor.Oldrea collects information about the OS and computer name.

Stuxnet collects system information including computer and domain names, OS version, and S7P paths.

IronWind can capture the OS version and computer name of the compromised host.

RotaJakiro executes a set of commands to collect device information, including `uname`. Another example is the `cat /etc/*release | uniq` command used to collect the current OS distribution.

Get2 has the ability to identify the computer name and Windows version of an infected host.

POWRUNER may collect information about the system by running hostname and systeminfo on a victim.

SharpStage has checked the system settings to see if Arabic is the configured language.

Sardonic has the ability to collect the computer name, and CPU manufacturer name from a compromised machine. Sardonic also has the ability to execute the `ver` and `systeminfo` commands.

HALFBAKED can obtain information about the OS, processor, and BIOS.

The initial beacon packet for Misdat contains the operating system version of the victim.

Emissary has the capability to execute ver and systeminfo commands.

KEYMARBLE has the capability to collect the computer name, language settings, the OS version, CPU information, and time elapsed since system start.

BUBBLEWRAP collects system information, including the operating system version and hostname.

HAWKBALL can collect the OS version, architecture information, and computer name.

Ursnif has used Systeminfo to gather system information.

ThreatNeedle can collect system profile information from a compromised host.

RansomHub can retrieve information about virtual machines.

ZLib has the ability to enumerate system information.

RedLeaves can gather extended system information including the hostname, OS version number, platform, memory information, time elapsed since system startup, and CPU information.

Tsundere Botnet has collected the machine’s MAC address, total memory, GPU information and other system information.

LITTLELAMB.WOOLTEA can check the type of Ivanti VPN device it is running on by executing `first_run()` to identify the first four bytes of the motherboard serial number.

Felismus collects the system information, including hostname and OS version, and sends it to the C2 server.

Zeus Panda collects the OS version, system architecture, computer name, product ID, install date, and information on the keyboard mapping to determine the language used on the system.

Havoc can gather system information including hostname, domain, and OS details.

CARROTBAT has the ability to determine the operating system of the compromised host and whether Windows is being run with x86 or x64 architecture.

GravityRAT collects the MAC address, computer name, and CPU information.

InvisibleFerret has collected OS type, hostname and system version through the "pay" module. InvisibleFerret has also queried the victim device using Python scripts to obtain the User and Hostname.

Bankshot gathers system information, network addresses, and the operation system version.

can collect system information, including computer name, system manufacturer, IsDebuggerPresent state, and execution path.

PLAINTEE collects general system enumeration data about the infected machine and checks the OS version.

Pony has collected the Service Pack, language, and region information to send to the C2.

WinMM collects the system name, OS version including service pack, and system install date and sends the information to the C2 server.

TONESHELL has the ability to retrieve the name of the infected machine.

Kasidet has the ability to obtain a victim's system name and operating system version.

OceanSalt can collect the computer name from the system.

Brave Prince collects hard drive content and system configuration information.

Medusa Ransomware has collected data from the SMBIOS firmware table using `GetSystemFirmwareTable`.

AppleSeed can identify the OS version of a targeted system.

macOS.OSAMiner can gather the device serial number.

NETWIRE can discover and collect victim system information.

EnvyScout can determine whether the ISO payload was received by a Windows or iOS device.

SslMM sends information to its hard-coded C2, including OS version, service pack information, processor speed, system name, and OS install date.

IMAPLoader uses WMI queries to gather information about the victim machine.

Gomir collects information on infected systems such as hostname, username, CPU, and RAM information.

Aria-body has the ability to identify the hostname, computer name, Windows version, processor speed, and machine GUID on a compromised host.